namespace ZB.MOM.WW.Secrets.MasterKey;

/// <summary>
/// Identifies where a <see cref="MasterKeyProviderBase"/> resolves its 32-byte master key (KEK) from.
/// </summary>
public enum MasterKeySource
{
    /// <summary>Read a base64-encoded key from an environment variable.</summary>
    Environment,

    /// <summary>Read the key from a file (raw 32 bytes, or base64 text).</summary>
    File,

    /// <summary>Unprotect a DPAPI-sealed blob file (Windows / <see cref="System.Security.Cryptography.DataProtectionScope.CurrentUser"/>).</summary>
    Dpapi,
}

/// <summary>
/// Configures which master-key (KEK) source a <see cref="MasterKeyProviderFactory"/> selects and how
/// it resolves the key material.
/// </summary>
/// <remarks>
/// This is the minimal master-key config shape, kept here in the MasterKey folder so the providers do
/// not take a forward dependency on the full application-level secrets options (composed later).
/// </remarks>
public sealed class MasterKeyOptions
{
    /// <summary>The source the master key is resolved from. Defaults to <see cref="MasterKeySource.Environment"/>.</summary>
    public MasterKeySource Source { get; set; } = MasterKeySource.Environment;

    /// <summary>
    /// The environment variable holding the base64-encoded 32-byte key, used when
    /// <see cref="Source"/> is <see cref="MasterKeySource.Environment"/>. Defaults to
    /// <c>ZB_SECRETS_MASTER_KEY</c>.
    /// </summary>
    public string EnvVarName { get; set; } = "ZB_SECRETS_MASTER_KEY";

    /// <summary>
    /// The path to the key file, used when <see cref="Source"/> is <see cref="MasterKeySource.File"/>
    /// or <see cref="MasterKeySource.Dpapi"/>.
    /// </summary>
    public string? FilePath { get; set; }

    /// <summary>
    /// An optional explicit key-encryption-key identifier. When non-empty it is used verbatim as the
    /// provider's <see cref="Abstractions.IMasterKeyProvider.KekId"/>; otherwise a deterministic,
    /// non-secret id is derived from the key material.
    /// </summary>
    public string? KekId { get; set; }
}
